CVE-2025-14481

MediumCVSS 4.3

Published: 27/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Yoast SEO plugin for WordPress up to version 26.5 is vulnerable to Insecure Direct Object References (IDOR) in the Meta Search REST API endpoint. It lacks proper authorization checks to verify post ownership, allowing authenticated attackers with Contributor-level access or higher to read sensitive SEO metadata from any post on the site, including other users' posts, private posts, and drafts.

Risk Assessment

The organization risks exposure of confidential SEO data, which could reveal ranking strategies, non-public content, or site structure information.

Recommendation

Immediately update the Yoast SEO plugin to the latest available version that includes a fix for this vulnerability.

Other vulnerabilities in Yoast SEO

CVE-2026-15425Medium
The Yoast SEO plugin for WordPress up to version 28.0 is vulnerable to stored XSS via the Post Slug (post_name) field. Authenticated attackers with author-level access or higher can inject malicious scripts that execute when a user visits the affected page. Pretty permalinks must be enabled.

Original NVD description (English source)

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS